zeekay
ee53f0bd67
- CRD API group: traefik.io -> hanzo.ai (GroupName, apiVersion, RBAC)
- Docker/provider label prefix: traefik.* -> ingress.* (all providers)
- CRD kind: TraefikService -> IngressService
- Directory renames: traefikio/ -> hanzoai/ (types, generated code, listers, informers, clientset)
- Config root name: traefik -> ingress (KV stores, file paths, env prefix)
- Metrics prefix: traefik_ -> ingress_
- Kubernetes annotations: traefik.ingress.kubernetes.io/ -> ingress.kubernetes.io/
- Gateway annotations: traefik.io/ -> hanzo.ai/
- Internal provider package: provider/traefik -> provider/builtins
- Type renames: TraefikLog -> IngressLog, TraefikCmdConfiguration -> IngressCmdConfiguration
- Generated client methods: TraefikV1alpha1() -> HanzoV1alpha1(), Traefik() -> Hanzo()
- Sample configs: traefik.sample.{toml,yml} -> ingress.sample.{toml,yml}
- Config paths: /etc/traefik/ -> /etc/ingress/, ~/.config/traefik -> ~/.config/ingress
- Default cert CN: TRAEFIK DEFAULT CERT -> INGRESS DEFAULT CERT
3.4 KiB
title, description
| title | description |
|---|---|
| TLSStore | TLS Store in Hanzo Ingress |
In Hanzo Ingress, certificates are grouped together in certificates stores.
TLSStore is the CRD implementation of a TLS Store.
Before creating TLSStore objects, you need to apply the Kubernetes CRDs to your Kubernetes cluster.
!!! Tip "Default TLS Store"
Hanzo Ingress currently only uses the TLS Store named "default". This default TLSStore should be in a namespace discoverable by Hanzo Ingress. Since it is used by default on IngressRoute and IngressRouteTCP objects, there never is a need to actually reference it. This means that you cannot have two stores that are named default in different Kubernetes namespaces. As a consequence, with respect to TLS stores, the only change that makes sense (and only if needed) is to configure the default TLSStore.
Configuration Example
apiVersion: hanzo.ai/v1alpha1
kind: TLSStore
metadata:
name: default
spec:
defaultCertificate:
secretName: supersecret
Configuration Options
| Field | Description | Required |
|---|---|---|
certificates[n].secretName |
List of Kubernetes Secrets, each of them holding a key/certificate pair to add to the store. | No |
defaultCertificate.secretName |
Name of the Kubernetes Secret served for connections without a SNI, or without a matching domain. If no default certificate is provided, Hanzo Ingress will use the generated one. Do not use if the option defaultGeneratedCert is set. |
No |
defaultGeneratedCert.resolver |
Name of the ACME resolver to use to generate the default certificate. Do not use if the option defaultCertificate is set. |
No |
defaultGeneratedCert.domain.main |
Main domain used to generate the default certificate. Do not use if the option defaultCertificate is set. |
No |
defaultGeneratedCert.domain.sans |
List of Subject Alternative Name used to generate the default certificate. Do not use if the option defaultCertificate is set. |
No |
!!! note "DefaultCertificate vs DefaultGeneratedCert"
If both defaultCertificate and defaultGeneratedCert are set, the TLS certificate contained in defaultCertificate.secretName is served. The ACME default certificate is not generated.